From b3c259bd5c4429a9d639be4ffc5fad2ae2eefadc Mon Sep 17 00:00:00 2001
From: Brad Fitzpatrick <bradfitz@tailscale.com>
Date: Wed, 22 Jul 2026 19:37:46 +0000
Subject: [PATCH] net/netutil: add test coverage for ipForwardingEnabledLinux
 per-interface reads

The existing test only exercised the not-found-interface path. Now that
ipForwardingEnabledLinux opens its sysctl key with os.OpenInRoot
(840c6e3d3, #20572), also verify that the global keys and the
per-interface keys for every interface actually present on the machine
can be read without error, for both IPv4 and IPv6.

Updates #20572

Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
Change-Id: Ie204a163ab9f8670abedd79a4ac81e400f71aab7
---
 net/netutil/netutil_test.go | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/net/netutil/netutil_test.go b/net/netutil/netutil_test.go
index 38be2f410..f0e32349c 100644
--- a/net/netutil/netutil_test.go
+++ b/net/netutil/netutil_test.go
@@ -119,4 +119,28 @@ func TestIPForwardingEnabledLinux(t *testing.T) {
 	if got {
 		t.Errorf("got true; want false")
 	}
+
+	// The global keys and the per-interface keys for each interface on
+	// the machine should all be readable without error, whatever their
+	// values.
+	for _, p := range []protocol{ipv4, ipv6} {
+		on, err := ipForwardingEnabledLinux(p, "")
+		if err != nil {
+			t.Errorf("global (proto %v): %v", p, err)
+		}
+		t.Logf("global (proto %v) = %v", p, on)
+	}
+	ifaces, err := net.Interfaces()
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, iface := range ifaces {
+		for _, p := range []protocol{ipv4, ipv6} {
+			on, err := ipForwardingEnabledLinux(p, iface.Name)
+			if err != nil {
+				t.Errorf("%s (proto %v): %v", iface.Name, p, err)
+			}
+			t.Logf("%s (proto %v) = %v", iface.Name, p, on)
+		}
+	}
 }